Detecting Lateral Movement with Open-Source Network Monitoring & MITRE ATT&CK

Lateral movement is how a cyberattack graduates from a limited breach to a data loss disaster. To cut down on attacker dwell time and reduce opportunity for lateral movement, organisations are advised to leverage the MITRE ATT&CK framework to look out for malicious actors’ TTPs, with an approach focused on visibility and explainable, evidence-based analytics. And to help execute this strategy, organizations can use telemetry data from open-source network analysis tools such as Zeek to capture and investigate activity across a broad set of network protocols. On 2 July 2024 at 1:00 p.m. BST Corelight and ISC2 will share how to make the most of MITRE ATT&CK and Zeek to: - Find pass the hash attacks whereby attackers authenticate without the user's cleartext password. - Spot attempts to gain unauthorized interactive access to workstations and servers via RDP. - Monitor FTP for potential transfers of malicious toolkits into your environment.